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Open statement ahead of expected final trilogue on 
General Data Protection Regulation 











BRUSSELS (December 14th 2015) — On 25 January 2012, the European Commission published its ambitious draft 
General Data Protection Regulation (GDPR), which sets out to harmonise Europe’s fragmented approach to data 
privacy. As the voice of the digital technology sector in Europe, DIGITALEUROPE has supported this vision. We 
believe that a harmonised EU law has the potential to stimulate economic growth and create new jobs, while 
providing citizens with effective control over their personal information. However, we have stressed that the goal 
of harmonisation must not come at any cost and that the right balance between boosting business 
competitiveness and safeguarding citizens’ privacy must be found. 


The importance of reaching this balance has increased following the publication of the European Commission’s 
strategy for a Digital Single Market, which identifies the GDPR as a core pillar for its overall success. With Europe’s 
future Digital Single Market set to rely heavily on the use of data to generate an anticipated €415bn+ of additional 
economic gain, it is difficult to overstate the importance of the GDPR to Europe’s ambitions to secure its digital 
future. It has become clear to all that if Europe wants to continue to grow its economy and remain competitive 
on a global stage, it must adopt a law which will allow for this. 


However, as the EU institutions enter the final stages of negotiations on the draft Regulation, the question over 
whether a proper balance has been reached between supporting privacy rights and enhancing economic 
competitiveness still remains. Following almost four years of negotiations, it is troubling that this question must still 
be asked. 


Against this backdrop, DIGITALEUROPE wishes to voice our deep concern that the original objectives of the 
European Commission’s proposal have been overshadowed by disproportionate and unbalanced rules. We fear 
that the expected agreement set to be reached during the trilogue discussions on 15 December 2015 will severely 
undermine the ability of European businesses to invest, innovate and create jobs. Such an agreement would mean 
that the much sought after balance would be lost. 


Recent statements? from the European Commission seem to fail to recognise this risk. As early as November 2012 
a UK Government study? estimated an unbalanced Regulation would result in UK companies alone facing up to 
£360m net compliance costs per year. A study* in May 2013 for the Dutch Government estimated a €1.1bn 
additional cost for Dutch businesses. Negotiations since will likely further inflate these costs. 


DIGITALEUROPE wishes to reiterate that our member companies take the fundamental right to privacy very 
seriously. This right must be ensured and is non-negotiable. However, as spelled out in the European 
Commission’s 2012 Communication ‘the right to the protection of personal data is not an absolute right, but must 
be considered in relation to its function in society and be balanced with other rights...’° It is the duty of negotiators 
to balance this fundamental right with other fundamental rights, which ensure job creation, growth, 
competitiveness and investment. 





1 COM(2015) 192 final 

2 Opening speech at 6th Annual European Data Protection and Privacy Conference — 10 December 2015 

3 UK Ministry of Justice Impact Assessment on Proposal for an EU Data Protection Regulation -22 November 2012 
4 CRC/CPR 13-14a Toetsing Europese Dataprotectieverordening — 31 May 2013 

5 COM(2012) 9 final 
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We therefore call once more on the trilogue negotiators to consider the following recommendations ahead of 
the final trilogue discussions: 


e Ensure a truly harmonised Regulation by rejecting the inclusion of language which allows Member States 
to determine more precisely the conditions under which personal data processing is lawful. 


e Avoid the introduction of unworkable provisions on consent, including raising the age of parental consent 
to 16, which deviates from industry best practices and makes it unnecessarily burdensome for parents 
and children of appropriate age and maturity to access offline and online services. 


e Refrain from adopting provisions which will severely limit the creation of a true ‘data driven’ European 
economy, such as an overly constraining interpretation of purpose limitation and limits to the use of 
profiling. 


e Avoid the creation of a ‘one-size-fits-all’ liability scheme, which will stifle the European data processing 
market and blur the lines of the data value chain. 


e Reject the inclusion of provisions into the international data transfer framework, which would place 
companies in a conflict of law situation with third country administrative authorities. 


e Avoid the introduction of a sanctions regime which is disproportionate, rigid and sets penalties based on 
global turnover, including revenue that are entirely unrelated to data processing activities. 


e Refrain from assembling a one-stop-shop mechanism, which drastically departs from the stated aim of 
the reform by failing to reduce administrative burdens for entities operating in the Internal Market. 


These points are of serious and existential importance. We urge legislators to take into account these final 
important points so that Europe’s future privacy regime enhances the development of the Digital Single Market, 
rather than hampering it. 


For more information please contact: 
Paul Meller, DIGITALEUROPE’s Communications Director 
+32 497 322 966 or paul.meller@digitaleurope.org 
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ABOUT DIGITALEUROPE 


DIGITALEUROPE represents the digital technology industry in Europe. Our members include some of the world's largest IT, 
telecoms and consumer electronics companies and national associations from every part of Europe. DIGITALEUROPE wants 
European businesses and citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the 
world's best digital technology companies. 


DIGITALEUROPE ensures industry participation in the development and implementation of EU policies. DIGITALEUROPE’ s 
members include 60 corporate members and 37 national trade associations from across Europe. Our website provides 
further information on our recent news and activities: http://www.digitaleurope.org 





DIGITALEUROPE MEMBERSHIP 
Corporate Members 


Alcatel-Lucent, AMD, Apple, BlackBerry, Bose, Brother, CA Technologies, Canon, Cassidian, Cisco, Dell, Epson, Ericsson, 
Fujitsu, Google, Hitachi, Hewlett Packard, Huawei, IBM, Ingram Micro, Intel, iQor, JVC Kenwood Group, Konica Minolta, 
Kyocera, Lenovo, Lexmark, LG Electronics, Loewe, Microsoft, Mitsubishi Electric Europe, Motorola Mobility, Motorola 
Solutions, NEC, Nokia, Nvidia Ltd., Océ, Oki, Oracle, Panasonic Europe, Philips, Pioneer, Qualcomm, Ricoh Europe PLC, 
Samsung, SAP, SAS, Schneider Electric IT Corporation, Sharp Electronics, Siemens, Sony, Swatch Group, Technicolor, Texas 
Instruments, Toshiba, TP Vision, Western Digital, Xerox, Zebra Technologies, ZTE Corporation. 


National Trade Associations 


Austria: IOO Germany: BITKOM, ZVEI Slovakia: ITAS 

Belarus: INFOPARK Greece: SEPE Slovenia: GZS 

Belgium: AGORIA Hungary: IVSZ Spain: AMETIC 

Bulgaria: BAIT Ireland: ICT IRELAND Sweden: Foreningen Teknikföretagen i 
Cyprus: CITEA Italy: ANITEC Sverige, IT&Telekomföretagen 
Denmark: DI ITEK, IT-BRANCHEN Lithuania: INFOBALT Switzerland: SWICO 

Estonia: ITL Netherlands: Nederland ICT, FIAR Turkey: Digital Turkey Platform, ECID 
Finland: FFTI Poland: KIGEIT, PIIT, Zipsee Ukraine: IT UKRAINE 

France: AFDEL, AFNUM, Force Portugal: AGEFE United Kingdom: techUK 

Numérique Romania: ANIS, APDETIC 
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